Safety features for integrated insulin delivery system

ABSTRACT

Safety features are applied to an integrated insulin delivery system to enhance safety while accounting for glucose sensor bias and calibration errors. One safety feature includes comparisons of calibrations of the sensor to nominal sensitivity and taking action, such as limiting insulin delivery or taking a further calibration of the sensor. In another feature, an automatic resumption of a basal delivery rate is programmed into the delivery device to avoid the possibility of complete loss of delivery of insulin in the event that communication with the delivery device is disrupted. Other features include steps taken to avoid hypoglycemia in the event that the sensor is negatively biased.

CROSS-REFERENCES TO RELATED APPLICATIONS

This application claims the benefit of U.S. Application No. 61/180,627,filed May 22, 2009 which is incorporated by reference in its entirety.

This application is also related to U.S. application Ser. No. ______entitled “Methods For Reducing False Hypoglycemia Alarm Occurrence,”(U.S. Provisional No. 61/180,700, filed May 22, 2009); U.S. applicationSer. No. ______ entitled “Usability Features For Integrated InsulinDelivery System,” (U.S. Provisional Application No. 61/180,649, filedMay 22, 2009); U.S. application Ser. No. ______ entitled “Safety LayerFor Integrated Insulin Delivery System,” (U.S. Provisional ApplicationNo. 61/180,774, filed May 22, 2009); and U.S. application Ser. No.______ entitled “Adaptive Insulin Delivery System,” (U.S. ProvisionalApplication No. 61/180,767, filed May 22, 2009).

BACKGROUND

The invention is directed to an integrated system of glucose leveldetection and use of that information in setting insulin deliveryparameters.

Diabetes is a metabolic disorder that afflicts tens of millions ofpeople throughout the world. Diabetes results from the inability of thebody to properly utilize and metabolize carbohydrates, particularlyglucose. Normally, the finely-tuned balance between glucose in the bloodand glucose in bodily tissue cells is maintained by insulin, a hormoneproduced by the pancreas which controls, among other things, thetransfer of glucose from blood into body tissue cells. Upsetting thisbalance causes many complications and pathologies including heartdisease, coronary and peripheral artery sclerosis, peripheralneuropathies, retinal damage, cataracts, hypertension, coma, and deathfrom hypoglycemic shock.

In patients with insulin-dependent diabetes, the symptoms of the diseasecan be controlled by administering additional insulin (or other agentsthat have similar effects) by injection or by external or implantableinsulin pumps. The “correct” insulin dosage is a function of the levelof glucose in the blood. Ideally, insulin administration should becontinuously readjusted in response to changes in glucose level. Indiabetes management, “insulin” instructs the body's cells to take inglucose from the blood. “Glucagon” acts opposite to insulin, and causesthe liver to release glucose into the blood stream. The “basal rate” isthe rate of continuous supply of insulin provided by an insulin deliverydevice (pump). The “bolus” is the specific amount of insulin that isgiven to raise blood concentration of the insulin to an effective levelwhen needed (as opposed to continuous).

Presently, systems are available for monitoring glucose levels byimplanting a glucose sensitive probe into the patient. Such probesmeasure various properties of blood or other tissues, including opticalabsorption, electrochemical potential, and enzymatic products. Theoutput of such sensors can be communicated to a hand held device that isused to calculate an appropriate dosage of insulin to be delivered intothe blood stream in view of several factors, such as a patient's presentglucose level, insulin usage rate, carbohydrates consumed or to beconsumed and exercise, among others. These calculations can then be usedto control a pump that delivers the insulin, either at a controlledbasal rate, or as a bolus. When provided as an integrated system, thecontinuous glucose monitor, controller, and pump work together toprovide continuous glucose monitoring and insulin pump control.

Such systems at present require intervention by a patient to calculateand control the amount of insulin to be delivered. However, there may beperiods when the patient is not able to adjust insulin delivery. Forexample, when the patient is sleeping, he or she cannot intervene in thedelivery of insulin, yet control of a patient's glucose level is stillnecessary. A system capable of integrating and automating the functionsof glucose monitoring and controlled insulin delivery would be useful inassisting patients in maintaining their glucose levels, especiallyduring periods of the day when they are unable to intervene.

What has been needed, and heretofore unavailable, is an integrated,automated system combining continuous glucose monitoring and controlledinsulin delivery. Such a system would include various features to insurethe accuracy of the glucose monitor and to protect the user from eitherunder- or over-dosage of insulin. The system would include variousfunctions for improving the usability, control, and safety of thesystem, including a variety of alarms which could be set by a user or atechnician to avoid false alarms while ensuring adequate sensitivity toprotect the user. The present invention fulfills these, and other needs.

SUMMARY OF THE INVENTION

In accordance with aspects of the invention, there is provided a systemfor the delivery of insulin to a patient, the system comprising acontinuous glucose sensor configured to provide a sensor glucose levelsignal representative of sensed glucose, the sensor having a nominalsensor sensitivity, an insulin delivery device configured to deliverinsulin to a patient in response to control signals, and a controllerprogrammed to receive the sensor glucose level signal, receive thenominal sensor sensitivity, and receive a sensor sensitivitymeasurement, and to provide and adjust a delivery control signal to thedelivery device as a function of the sensor glucose level signal and thecomparison of the sensor sensitivity measurement with the nominal sensorsensitivity.

In more detailed aspects, the controller further comprises one or moresafety-oriented components in the controller that modifies its controlbehavior as a function of estimated calibration accuracy. The controllerestimates the calibration accuracy based on present and past data fromthe current sensor wear as well as past offline data. A safety-orientedcomponent attempts to detect a sensor calibration anomaly and makeappropriate adjustment to one or more aspects of the controller, such asthe controller's target glucose range limits, the variance of one ormore glucose state estimates, the variance of one or more glucose sensormeasurement channels, a calibration correction factor to be used inconjunction with a sensor's signal, the decision to request arecalibration, and the decision to terminate closed-loop operation.

In other aspects, there is provided a system for the delivery of insulinto a patient, the system comprising a continuous glucose sensorconfigured to provide a sensor glucose level signal representative ofsensed glucose an insulin delivery device configured to deliver insulinto a patient in response to control signals at a basal rate and as abolus and a controller programmed to receive the sensor glucose levelsignal and to provide a delivery control signal to the delivery deviceto suspend a basal delivery rate during the provision of a bolusdelivery and to automatically resume a preprogrammed basal delivery rateafter a selected event.

In further detailed aspects, the delivery signal comprises automaticresumption of the basal delivery rate after the event of termination ofthe bolus rate, the delivery signal comprises automatic resumption ofthe basal delivery rate after the event of a certain period of time, andthe delivery signal comprises automatic resumption of the basal deliveryrate after consideration of the insulin on board.

In other aspects, there is provided a system for the delivery of insulinto a patient, the system comprising a continuous glucose sensorconfigured to provide a sensor glucose level signal representative ofsensed glucose, an insulin delivery device configured to deliver insulinto a patient in response to control signals at a basal rate and as abolus, and a controller programmed to receive the sensor glucose levelsignal and to provide a delivery control signal to the delivery deviceaccording to a model, that model including a monitor on the lower levelof insulin over the course of time such that if the control signal wereto reduce the insulin below a threshold or terminate insulin delivery,the model intervenes within a reasonable duration to cause a furtheraction to avoid hypoglycemia.

In more detailed aspects, the model intervenes until the risk ofover-compensating in the opposite direction is determined to be higherthan not intervening. The model intervenes within a reasonable durationbut when the reasonable duration is exceeded and the model suggests thatthe risk level is still unacceptable, the model considers taking anotheraction, such as recalibration or the termination of full or partialsystem automation.

In another aspect, there is provided a system for the delivery ofinsulin to a patient, the system comprising a continuous glucose sensorconfigured to provide a sensor glucose level signal representative ofsensed glucose, an insulin delivery device configured to deliver insulinto a patient in response to control signals at a basal rate and as abolus, and a controller programmed to receive the sensor glucose levelsignal and to provide a delivery control signal to the delivery deviceto deliver insulin that accounts for an asymmetrical bias range of theglucose sensor such that inaccuracy in the sensor may be tolerated withlimited hyperglycemia while avoiding hypoglycemia.

In yet a further aspect, there is provided a system for the delivery ofinsulin to a patient, the system comprising a continuous glucose monitorconfigured to provide a glucose level signal representative of sensedglucose, an insulin delivery device configured to deliver insulin to apatient in response to control signals, and a controller programmed toprovide control signals to the delivery device to result in a basal rateof delivery and bolus delivery, the controller also programmed toreceive the glucose level signal and indicate recommended changes to thedelivery of insulin and/or alter the delivery as a function of glucoselevel signals.

In more detailed aspects, the controller provides control signals toalter the delivery of insulin based on a glucose level signal indicatingexisting, imminent, or a trend toward carbohydrate deficiency. Further,the controller provides control signals to terminate an extended bolusand terminate a temporary basal rate that exceeds a programmed basalrate, in response to a glucose signal indicating existing or imminentcarbohydrate deficiency. Additionally, the controller provides controlsignals to terminate a programmed basal rate and alter future basaldelivery in response to a glucose signal indicating existing or imminentcarbohydrate deficiency, and the controller receives the glucose signal,informs of the trend toward carbohydrate deficiency, and indicates anoption of consuming carbohydrates to alter the trend.

In another aspect, the present invention includes a system for thedelivery of insulin to a patient, the system comprising a continuousglucose sensor configured to provide a glucose level signalrepresentative of sensed glucose, the sensor having a nominal sensorsensitivity; an insulin delivery device configured to deliver insulin toa patient in response to delivery control signals; and a controllerprogrammed to receive the glucose level signal, receive the nominalsensor sensitivity, and receive a sensor sensitivity measurement, and todetermine a delivery control signal to control the delivery device inaccordance with the sensor glucose level signal and a comparison of thesensor sensitivity measurement with the nominal sensor sensitivity.

In one alternative aspect, the controller further comprises one or moresafety-oriented components programmed in the controller by softwarecommands that modifies the control behavior of the processor such thatthe behavior of the processor is a function of estimated sensorcalibration accuracy. In another alternative aspect, the controllerestimates the sensor calibration accuracy based on present and past datafrom the glucose sensor as well as past offline data.

In yet another alternative aspect, a safety-oriented componentprogrammed in the processor by software commands detects a sensorcalibration anomaly and adjusts at least one parameter selected from thelist of parameters consisting of target glucose range limits, a varianceof one or more glucose state estimates, a variance of one or moreglucose sensor measurement channels, a calibration correction factor tobe used in conjunction with the glucose sensor's glucose level signal, adecision by the processor based upon data available from the glucosesensor and at least one other selected parameter value to request arecalibration, and a decision by the processor based upon data availablefrom the glucose sensor and at least one other selected parameter valueto terminate closed-loop operation.

In a further aspect, the present invention includes a system for thedelivery of insulin to a patient, the system comprising a continuousglucose sensor configured to provide a glucose level signalrepresentative of sensed glucose; an insulin delivery device configuredto deliver insulin in response to delivery control signals at a basalrate and as a bolus; and a controller programmed to receive the sensorglucose level signal and to provide a delivery control signal to aninsulin delivery device to suspend a basal delivery rate during theprovision of a bolus delivery and to automatically resume apreprogrammed basal delivery rate after a selected event.

In one alternative aspect, the delivery control signal comprisesautomatic resumption of the basal delivery rate after termination of thebolus rate. In another alternative aspect, the delivery control signalcomprises automatic resumption of the basal delivery rate after aselected period of time has elapsed since termination of the basaldelivery rate. In still another alternative aspect, the delivery controlsignal comprises automatic resumption of the basal delivery rate aftercomparison of a value of insulin on board as determined by the processorto a selected threshold value for insulin on board stored in a memory inoperable communication with the processor.

In yet another aspect, the present invention includes a system for thedelivery of insulin to a patient, the system comprising a continuousglucose sensor configured to provide a glucose level signalrepresentative of sensed glucose; an insulin delivery device configuredto deliver insulin in response to delivery control signals at a basalrate and as a bolus; and a controller programmed to receive the sensorglucose level signal and to provide a delivery control signal to theinsulin delivery device according to a model, the model including amonitor on the lower level of insulin over the course of time such thatif the delivery control signal reduces the insulin delivery below athreshold or terminates insulin delivery, the processor modelprogramming of the processor results in an intervention in the deliveryof insulin by the pump to avoid hypoglycemia.

In more detailed aspects, the model programming of the processor resultsin an intervention in the delivery of insulin until the risk ofover-compensating in an opposite direction is determined to be higherthan not intervening in the insulin delivery. In a still more detailedaspect, the model programming of the processor results in anintervention of the insulin delivery within a selected duration but whenthe selected duration is exceeded and the model programming of theprocessor suggests that the risk level is still unacceptable, the modelprogramming of the processor evaluates taking another action, such asrecalibration or termination of full or partial system automation.

In another aspect, the present invention includes a system for thedelivery of insulin to a patient, the system comprising a continuousglucose sensor configured to provide a glucose level signalrepresentative of sensed glucose; an insulin delivery device configuredto deliver insulin to a patient in response to delivery control signalsat a basal rate and as a bolus; and a controller programmed to receivethe sensor glucose level signal and to provide a delivery control signalto the insulin delivery device to deliver insulin in a manner thataccounts for an asymmetrical bias range of the glucose sensor such thatinaccuracy in the sensor may be tolerated with limited hyperglycemiawhile avoiding hypoglycemia.

In yet a further aspect, the present invention includes a system for thedelivery of insulin to a patient, the system comprising a continuousglucose monitor configured to provide a glucose level signalrepresentative of sensed glucose; an insulin delivery device configuredto deliver insulin to a patient in response to delivery control signals;and a controller programmed to provide control signals to the deliverydevice to result in a basal rate of delivery and bolus delivery, thecontroller also programmed to receive the glucose level signal and toindicate recommended changes to the delivery of insulin and/or alter thedelivery of insulin as a function of the glucose level signals.

In a more detailed aspect, the controller provides delivery controlsignals to alter the delivery of insulin based on a glucose level signalindicating existing, imminent, or a trend toward carbohydratedeficiency.

In another more detailed aspect, the controller provides deliverycontrol signals to terminate an extended bolus and to terminate atemporary basal rate that exceeds a programmed basal rate in response toa glucose signal indicating existing or imminent carbohydratedeficiency. In still another more detailed aspect, the controllerprovides delivery control signals to terminate a programmed basal rateand alter future basal delivery of insulin in response to a glucosesignal indicating existing or imminent carbohydrate deficiency.

In yet another more detailed aspect, the controller receives the glucoselevel signal from the sensor; informs a patient of a trend in thepatient's glucose level toward carbohydrate deficiency; and indicates anoption of consuming carbohydrates to alter the trend to the patient.

The features and advantages of the invention will be more readilyunderstood from the following detailed description which should be readin conjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram illustrating an exemplary embodiment of anelectronic device and its various components in operable communicationwith one or more medical devices, such as a glucose monitor or drugdelivery pump, and optionally, in operable communication with a remotecomputing device;

FIG. 2 is a graphical representation of a glucose profile showingglucose level measured using a CGM sensor as a function of time, andalso showing the variation of the glucose level as function ofcarbohydrate intake and insulin administration.

FIG. 3 presents a series of receiver operation curves useful fordetecting positive calibration bias based on estimated fractionalaccuracy;

FIG. 4 is an example of determining the maximum allowable truecalibration error in terms of hypoglycemic severity under closed loopdelivery; and

FIG. 5 shows the use of a single estimated fractional accuracy detectorto determine different independent closed loop control parameteradjustments or trigger glucose reading requests.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

For the purposes of promoting an understanding of the principles of theinvention, reference will now be made to a number of illustrativeembodiments shown in the attached drawings and specific language will beused to describe the same. It will be understood that throughout thisdocument, the terms “user” and “patient” are used interchangeably.

Referring now to FIG. 1, a block diagram of one illustrative embodimentof a system 10 for monitoring, determining and/or providing drugadministration information is shown. In the illustrated embodiment, thesystem 10 includes an electronic device 12 having a processor 14 in datacommunication with a memory unit 16, an input device 18, a display 20,and a communication input/output unit 24. The electronic device 12,which may be handheld, may be provided in the form of a general purposecomputer, central server, personal computer (PC), laptop or notebookcomputer, personal data assistant (PDA) or other hand-held device,external infusion pump, glucose meter, analyte sensing system, or thelike. The electronic device 12 may be configured to operate inaccordance with one or more operating systems including for example, butnot limited to, WINDOWS, Unix, LINUX, BSD, SOLARIS, MAC OS, or, anembedded OS such as ANDROID, PALM OS, WEBOS, eCOS, QNX, or WINCE, andmay be configured to process data according to one or more internetprotocols for example, but not limited to, NetBios, TCP/IP andAPPLETALK. The processor 14 is microprocessor-based, although theprocessor 14 may be formed of one or more general purpose and/orapplication specific circuits and operable as described hereinafter. Thememory unit 16 includes sufficient capacity to store operational data,one or more software algorithms executable by the processor 14, andother user inputted data. The memory unit 16 may include one or morememory or other data storage devices.

Display 20 is also included for viewing information relating tooperation of the device 12 and/or system 10. Such a display may be adisplay device including for example, but not limited to, a lightemitting diode (LED) display, a liquid crystal display (LCD), a cathoderay tube (CRT) display, or the like. Additionally, display 20 mayinclude an audible display configured to communicate information to auser, another person, or another electronic system having audiorecognition capabilities via one or more coded patterns, vibrations,synthesized voice responses, or the like. Additionally, display 20 mayinclude one or more tactile indicators configured to display tactileinformation that may be discerned by the user or another person.

Input device 18 may be used in a manner to input and/or modify data.Input device 18 may include a keyboard or keypad for enteringalphanumeric data into the processor 14. Such a keyboard or keypad mayinclude one or more keys or buttons configured with one or more tactileindicators to allow users with poor eyesight to find and select anappropriate one or more of the keys, and/or to allow users to find andselect an appropriate one or more of the keys in poor lightingconditions. Additionally, input device 18 may include a mouse or otherpoint and click device for selecting information presented on thedisplay 20. Additionally, input device 18 may include display 20,configured as a touch screen graphical user interface. In thisembodiment, the display 20 includes one or more selectable inputs that auser may select by touching an appropriate portion of the display 20using an appropriate implement.

Input device 18 may also include a number of switches or buttons thatmay be activated by a user to select corresponding operational featuresof the device 12 and/or system 10. Input device 18 may also be orinclude voice-activated circuitry responsive to voice commands toprovide corresponding input data to the processor 14. The input device18 and/or display 20 may be included with or separate from theelectronic device 12.

System 10 may also include a number of medical devices 30 which carryout various functions, for example, but not limited to, monitoring,sensing, diagnostic, communication and treatment functions. In suchembodiments, any of the one or more of the medical devices 30, 32 may beimplanted within the user's body, coupled externally to the user's body(such as, for example, an infusion pump), or separate from the user'sbody. In some embodiments, medical devices 30, 32 are controlledremotely by electronic device 12. Additionally, one or more of themedical devices may be mounted to and/or form part of the electronicdevice 12. For example, in some embodiments, electronic device 12includes an integrated glucose meter or strip port and is configured toreceive a signal representative of a glucose value and display the valueto a user. Electronic device 12 may further be configured to be used tocalibrate a continuous glucose monitor (CGM) or for calculating insulinamounts for bolus delivery. Typically, the medical devices 30, 32 areeach configured to communicate wirelessly with the communication I/Ounit 22 of the electronic device 12 via one of a corresponding number ofwireless communication links. Wireless communication is preferable whenmedical devices 30, 32 are configured to be located on a remote part ofthe body, for example, in an embodiment wherein medical device 30, 32 isa continuous glucose monitor (CGM) or sensor, or insulin pump, wornunder clothing.

Electronic device 12 communicates with medical device 30, 32 via awireless protocol, or, in some embodiments, is directly connected via awire. The wireless communications between the various components of thesystem 10 may be one-way or two-way. The form of wireless communicationused may include, but should not be limited to, radio frequency (RF)communication, infrared (IR) communication, Wi-Fi, RFID (inductivecoupling) communication, acoustic communication, capacitive signaling(through a conductive body), galvanic signaling (through a conductivebody), BLUETOOTH, or the like. Electronic device 12 and each of themedical devices 30 include circuitry for conducting such wirelesscommunications circuit. In another embodiment, one or more of themedical devices 30, 32 may be configured to communicate with electronicdevice 12 via one or more serial or parallel configured hardwireconnections therebetween.

Each of the one or more medical devices 30, 32 may include one or moreof a processing unit 33, input 34 or output 36 circuitry and/or devices,communication ports 38, and/or one or more suitable data and/or programstorage devices 40. It may be understood that not all medical devices30, 32 will have the same componentry, but rather will only have thecomponents necessary to carry out the designed function of the medicaldevice. For example, in one embodiment, a medical device 30, 32 may becapable of integration with electronic device 12 and thus omit input 34,display 36, and/or processor 33. In another embodiment, medical device30, 32 is capable of stand-alone operation, and is further configured tofunction as electronic device 12, should communication with electronicdevice 12 be interrupted. In another embodiment, medical device 30, 32may include processor, memory and communication capability, but does nothave an input 34 or a display 36. In still another embodiment, themedical device 30, 32 may include an input 34, but lack a display 36.

In some embodiments, the system 10 may additionally include a remotedevice or devices 50, 52. The remote device 50, 52 may include aprocessor 53, which may be identical or similar to the processor 33 orprocessor 14, a memory or other data storage unit 54, a input device 56,which may include any one or more of the input devices describedhereinabove, a display unit 58 which may include any one or more of thedisplay units described hereinabove, and a communication I/O circuitry60. The remote device 50, 52 may be configured to communicate with theelectronic device 12 or medical devices(s) 30, 32 via any wired orwireless communication interface 62, which may include any of thecommunication interfaces or links described hereinabove. Although notspecifically shown, remote device 50, 52 may also be configured tocommunicate directly with one or more medical devices 30, 32, instead ofcommunicating with the medical device through electronic device 12.

System 10 may be provided in any of a variety of configurations, andexamples of some such configurations will now be described. It will beunderstood, however, that the following examples are provided merely forillustrative purposes, and should not be considered limiting in any way.Those skilled in the art may recognize other possible implementations ofa fully closed-loop, semi closed-loop, or open loop diabetes controlarrangement, and any such other implementations are contemplated by thisdisclosure.

In a first exemplary implementation of the system 10, the medical device32 is provided in the form of an insulin pump 32 configured to be wornexternally to the user's body and also configured to controllablydeliver insulin to the user's body. The various medical devices 30, 32may additionally include one or more sensors or sensing systems that areexternal to the user's body and/or sensor techniques for providinginformation relating to the physiological condition of the user.Examples of such sensors or sensing systems may include, but should notbe limited to, a glucose strip sensor/meter, a body temperature sensor,a blood pressure sensor, a heart rate sensor, one or more bio-markersconfigured to capture one or more physiological states of the body, suchas, for example, HBA1C, or the like. In implementations that include aglucose sensor, system 10 may be a fully closed-loop system operable ina manner to automatically monitor glucose level and deliver insulin, asappropriate, to maintain glucose level at desired levels. Informationprovided by any such sensors and/or sensor techniques may becommunicated by system 10 using any one or more wired or wirelesscommunication techniques.

In an implementation of the system 10, the electronic device 12 isprovided in the form of a handheld device, such as a PDA or otherhandheld device. In this example, medical devices 30, 32 include atleast one implantable or externally worn drug pump. In one embodiment,an insulin pump is configured to controllably deliver insulin to theuser's body. In this embodiment, the insulin pump is also configured towirelessly transmit information relating to insulin delivery to thehandheld device 12. The handheld device 12 is configured to monitorinsulin delivery by the pump, and may further be configured to determineand recommend insulin bolus amounts, carbohydrate intake, exercise, andthe like to the user. The system 10 may be configured in this embodimentto provide for transmission of wireless information from the handhelddevice 12 to the insulin pump.

In a further embodiment, the handheld device 12 is configured to controlinsulin delivery to the user by determining insulin delivery commandsand transmitting such commands to an insulin pump 32. The insulin pump,in turn, is configured to receive the insulin delivery commands from thehandheld device 12, and to deliver insulin to the user according to thecommands. The insulin pump, in this embodiment, may further process theinsulin pump commands provided by the handheld unit 12. The system 10will typically be configured in this embodiment to provide fortransmission of wireless information from the insulin pump back to thehandheld device 12 to thereby allow for monitoring of pump operation.The system 10 may further include one or more implanted and/or externalsensors of the type described in the previous example.

Those skilled in the art will recognize other possible implementationsof a fully closed-loop, semi closed-loop, or open loop diabetes controlarrangement using at least some of the components of the system 10illustrated in FIG. 1. For example, the electronic device 12 in one ormore of the above examples may be provided in the form of a PDA, laptop,programmable cellular telephone, notebook or personal computerconfigured to communicate with one or more of the medical devices 30,32, at least one of which is an insulin delivery system, to monitorand/or control the delivery of insulin to the user. In furtherembodiments, electronic device may include a communication port 22 inthe form of a BLUETOOTH or other wireless transmitter/receiver, serialport or USB port, or other custom configured serial data communicationport. In some embodiments, remote device 50, 52 is configured tocommunicate with the electronic device 12 and/or one or more of themedical devices 30, 32, to control and/or monitor insulin delivery tothe patient, and/or to transfer one or more software programs and/ordata to the electronic device 12. Remote device 50, 52 may take the formof a PC, PDA, programmable cellular telephone, laptop or notebookcomputer, handheld or otherwise portable device, and may reside in acaregiver's office or other remote location. In the various embodiments,communication between the remote device and any component of the system10 may be accomplished via an intranet, internet (such as, for example,the world-wide-web), cellular, telephone modem, RF, USB connectioncable, or other communication link 62. Any one or more internetprotocols may be used in such communications. Additionally, any mobilecontent delivery system; e.g., Wi-Fi, WiMAX, BLUETOOTH, short messagesystem (SMS), or other message scheme may be used to provide forcommunication between devices comprising the system 10.

FIG. 1 illustrates the components, and operation and control flow, of atypical closed-loop system. In the depicted embodiment, the systemgenerally includes a sensor and a pump, and a controller module forreceiving input from the sensor and for controlling the pump. In someembodiments, the sensor and/or pump is part of, or includes medicaldevice 30, 32 (that is, medical device 30, 32 can be a pump or asensor). In some embodiments, the controller module may be part of, orbe integrated with, a sensor or a pump, or other medical devices 30, 32.In some embodiments, the controller module is part of, or comprises,electronic device 12. Thus, the controller module is depicted in thedrawings as a handheld electronic device 12. Handheld controller 12preferably has a user interface screen 20 to display information to theuser and to request from the user the input of parameters and/orcommands. Handheld controller 12 may further comprise a processor 14,and an input means 18, such as buttons or a touch screen, for the userto input and/or set parameters and commands to the system.

Handheld controller 12 includes a memory means 16 configured to storeparameters and one or more algorithms that may be executed by processor14. For example, memory means 16 may store one or more predeterminedparameters or algorithms to evaluate glucose data, trends in that data,and future prediction models. A user may also input parameters usinginput 18 to provide patient-specific algorithms such as pumping patternsor algorithms for determining an amount of drug (i.e., insulin) to bedelivered by an insulin delivery device (IDD), such as, for example, apump. Input 18 may also be used to send commands or to bring up a menuof commands for the user to choose from. In some embodiments, thesecomponents (i.e., input, processor, and memory) comprise the controlmodule of the present invention. The information may be displayed, forexample, on display 20 of handheld controller 12, and user input may bereceived via input 18. In one embodiment, handheld controller 12 takesinto account for both deliveries commanded by the controller as well asdeliveries commanded by human input intended to correct or compensatefor specific aspects not necessarily known to the controller. Thecomponents of the invention may cooperatively work together as a singledevice or separate physical devices.

In one embodiment, handheld controller 12 is provided to allow thepatient to view via graphical display 20 his or her glucose levelsand/or trends and to control the pump 32. Handheld controller 12 sendscommands to operate pump 32, such as an automatic insulin basal rate orbolus amount. Handheld controller 12 may automatically send commandsbased on input from a sensor or may send commands after receiving userinput via input 18 or input 34 on medical device 30, 32. In at least oneembodiment, handheld controller 12 analyzes data from the sensor and/orpump, and/or communicates data and commands to them. In one embodiment,handheld controller 12 automatically sends the commands to the pumpbased on a sensor reading. Handheld controller 12 may also send commandsto direct the pumping action of the pump. Handheld controller 12 sendsand receives data to and from the sensor over a wired connection orwireless communication protocol 42. In another embodiment, data based onthe reading is first provided to handheld controller 12 which analyzesthe data and presents information to a user or a health care provider(such as, for example, using remote device 50, 52), wherein human inputis required to generate the command. For example, handheld controller 12may request an acknowledgment or feedback from the user before sendingthe commands, allowing the user to intervene in command selection ortransmission. In a further embodiment, handheld controller 12 merelysends alerts or warnings to the user and allows the user to manuallyselect and send the commands via the input 18 of handheld controller 12.In yet another embodiment handheld controller 12 manages commandsoriginated by the control algorithm with or without user approval orintervention, and commands initiated by the user are independent of thecontrol algorithm. The purpose of handheld controller 12 is to processsensor data in real-time and determine whether the glucose levels in apatient is too high or too low, and to provide a prediction of futureglucose levels based upon sensor readings and the current basal rateand/or recent bolus injections.

In some embodiments, handheld controller 12 includes a means forcalibrating the system, including, inputting at the device a fingerstick glucose measurement or taking an actual blood sample to obtain aglucose measurement. The device may be integrated with a strip port sothat a user may use the strip port to take a manual glucose levelreading. The strip port includes a known calibration and is configuredto take a blood reading to provide a value representative of a glucoselevel. The reading provided from the strip port is internally receivedat handheld controller 12 and compared to a value from the sensor toconfigure and/or calibrate the system.

In some embodiments, one or more of medical devices 30, 32 may be asensor configured to measure a glucose level of a person and to send themeasurement to handheld controller 12 for analysis. In some embodiments,the sensor is a glucose level monitor with a strip port for manuallyreceiving a blood sample. In other embodiments, the sensor may be acontinuous glucose monitoring (CGM) sensor that pierces and/or is heldin place at the surface of a patient's skin to continuously monitorglucose levels in a person. In another embodiment, the CGM sensor(incorporated into medical device 30, 32) is attached to the surface ofa patient's skin and includes a small sensor device that at leastpartially pierces the patient's skin and is located in the dermis to bein contact the interstitial fluid. The sensor device may also be held inplace at the skin by a flexible patch. The CGM sensor is typically ananalyte monitoring system that may also include a transmitter and/orreceiver for transmitting sensor data to a separate device (such as, forexample, an insulin pump or handheld electronic device 12). In someembodiments, the CGM sensor is mounted on the skin of a user's arm.

In the various embodiments described herein, an insulin device or pumpdelivers insulin to the patient through a small tube and cannula, alsoknown as an “infusion set,” percutaneously inserted into the patient'sbody. The insulin pump may be in the form of a medical pump, a smallportable device (similar to a pager) worn on a belt or placed in apocket, or it may be in the form of a patch pump that is affixed to theuser's skin. In one embodiment, the pump is attached to the body by anadhesive patch and is normally worn under clothes. The pump includes apower supply, and is relatively small and of a low profile so that itcan be hidden from view in a pocket or attached to the skin under auser's clothing.

The insulin pump typically has disposable and non-disposable components.The disposable components generally include a reservoir and cannula andoptionally, an adhesive patch to hold the pump to the user's skin. Thenon-disposable/reusable components generally include the pumpingelectronics, transmitter and/or receiver, and pump mechanics (notshown). The pump and cannula may be part of the same physical device orcomprise separate modules. The pump may also comprise a transmitterand/or receiver for transmitting and/or receiving a signal viaconnection 42 from handheld controller 12 so that it can be controlledremotely and can report pump-specific data to the controller.Alternatively, the pump may also be configured to communicate with oneor more remote devices 50,52.

When provided as an integrated system, the components of system 10 worktogether to provide real-time continuous glucose monitoring and controlof an insulin pump and to allow a user to take immediate corrective orpreventative action when glucose levels are either too high or too low.Because the pump and sensor are miniaturized they may have very limitedcontrol panels, if any at all, and thus, in some embodiments, thesensor, pump, and controller 12 may all be integrated into a singledevice. In other embodiments, the sensor, pump, and controller 12 may beorganized as two or three separate components. The components may be inwired communication, radio communication, fluid connection, or othercommunication protocol suitable for sending and receiving informationbetween the components. Some components may be constructed to bereusable while others are disposable. For example, the cannula and thesensor may be disposable pieces apart from the pump and CGM sensor,which are both preferably reusable. The cannula and/or sensor willpreferably be in fluid isolation from other components. Each componentmay have modular fittings so that the disposable components may interactwith the non-disposable components while remaining in fluid isolationfrom each other.

FIG. 2 depicts a typical glucose absorption profile 200 for a usermeasured using a CGM sensor. The graph 205 plots the measured glucoselevel as a function of time. This profile shows the effect on glucoselevel of various actions, such as carbohydrate intake 210, and thedelivery of rapid acting insulin 210 and long acting insulin 230.

Generally, the concentration of glucose in a person changes as a resultof one or more external influences such as meals and exercise, and alsochanges resulting from various physiological mechanisms such as stress,illness, menstrual cycle and the like. In a person with diabetes, suchchanges can necessitate monitoring the person's glucose level andadministering insulin or other glucose level altering drug, as needed tomaintain the person's glucose level within desired ranges. In any of theabove examples, the system 10 is thus configured to determine, based onsome amount of user-specific information, an appropriate amount, typeand/or timing of insulin or other glucose level altering drug toadminister in order to maintain normal glucose levels without causinghypoglycemia or hyperglycemia.

In some embodiments, the system 10 is configured in a manner to controlone or more external (such as, for example, subcutaneous, transcutaneousor transdermal) and/or implanted insulin pumps to automatically infuseor otherwise supply the appropriate amount and type of insulin to theuser's body in the form of one or more insulin boluses. Such insulinbolus administration information may be or include, for example, insulinbolus quantity or quantities, bolus type, insulin bolus delivery time,times or intervals (such as, for example, single delivery, multiplediscrete deliveries, and continuous delivery), and the like. Examples ofuser supplied information may be, for example but not limited to, userglucose concentration, information relating to a meal or snack that hasbeen ingested, is being ingested, or is to be ingested sometime in thefuture, user exercise information, user stress information, user illnessinformation, information relating to the user's menstrual cycle, and thelike.

System 10 may also include a delivery mechanism for deliveringcontrolled amounts of a drug; such as, for example, insulin, glucagon,incretin, or the like to pump 30, and/or offering an actionable therapyrecommendation to the user via the display 20, such as, for example,ingesting carbohydrates, exercising, and the like. In other embodiments,the system 10 is configured in a manner to display or otherwise notifythe user of the appropriate amount, type, and/or timing of insulin inthe form of an insulin recommendation. In such embodiments, hardwareand/or software forming part of the system 10 allows the user to acceptthe recommended insulin amount, type, and/or timing, or to reject it. Ifaccepted, the system 10, in one embodiment, automatically infuses orotherwise provides the appropriate amount and type of insulin to theuser's body in the form of one or more insulin boluses. If, on the otherhand, the user rejects the insulin recommendation, hardware and/orsoftware forming the system 10 allows the user to override the system 10and manually enter insulin bolus quantity, type, and/or timing. Thesystem 10 is then configured in a manner to automatically infuse orotherwise provide the user specified amount, type, and/or timing ofinsulin to the user's body in the form of one or more insulin boluses.

The appropriate amount and type of insulin corresponding to the insulinrecommendation displayed by the system 10 may be manually injected into,or otherwise administered to, the patient's body. It will be understood,however, that the system 10 may additionally be configured in likemanner to determine, recommend, and/or deliver other types of medicationto a patient.

System 10 is operable to determine and either recommend or administer anappropriate amount of insulin or other glucose level lowering drug tothe patient in the form of one or more insulin boluses. In determiningsuch appropriate amounts of insulin, the system 10 requires at leastsome information relating to one or more external influences and/orvarious physiological mechanisms associated with the patient. Forexample, if the user is about to ingest, is ingesting, or has recentlyingested, a meal or snack, the system 10 generally requires someinformation relating to the meal or snack to determine an appropriateamount, type and/or timing of one or more meal compensation boluses.When a person ingests food in the form of a meal or snack, the person'sbody reacts by absorbing glucose from the meal or snack over time. Forpurposes of this disclosure, any ingesting of food may be referred tohereinafter as a “meal,” and the term “meal” therefore encompassestraditional meals, such as, for example, breakfast, lunch and dinner, aswell as intermediate snacks, drinks, and the like.

The general shape of a glucose absorption profile for any person risesfollowing ingestion of the meal, peaks at some measurable time followingthe meal, and then decreases thereafter. The speed, that is, the ratefrom beginning to completion, of any one glucose absorption profiletypically varies for a person by meal composition, by meal type or time(such as, for example, breakfast, lunch, dinner, or snack) and/oraccording to one or more other factors, and may also vary fromday-to-day under otherwise identical meal circumstances. Generally, theinformation relating to such meal intake information supplied by theuser to the system 10 should contain, either explicitly or implicitly,an estimate of the carbohydrate content of the meal or snack,corresponding to the amount of carbohydrates that the user is about toingest, is ingesting, or has recently ingested, as well as an estimateof the speed of overall glucose absorption from the meal by the user.

The estimate of the amount of carbohydrates that the user is about toingest, is ingesting, or has recently ingested, may be provided by thepatient in any of various forms. Examples include, but are not limitedto, a direct estimate of carbohydrate weight (such as, for example, inunits of grams or other convenient weight measure), an amount ofcarbohydrates relative to a reference amount (such as, for example,dimensionless), an estimate of meal or snack size (such as, for example,dimensionless), and an estimate of meal or snack size relative to areference meal or snack size (such as, for example, dimensionless).Other forms of providing for user input of carbohydrate content of ameal or snack will occur to those skilled in the art, and any such otherforms are contemplated by this disclosure.

The estimate of the speed of overall glucose absorption from the meal bythe patient may likewise be provided by the patient in any of variousforms. For example, for a specified value of the expected speed ofoverall glucose absorption, the glucose absorption profile captures thespeed of the meal taken by the user. As another example, the speed ofoverall glucose absorption from the meal by the user also includes timeduration between ingesting of the meal by a person and the peak glucoseabsorption of the meal by the user, which captures the duration of themeal taken by the user. The speed of overall glucose absorption may thusbe expressed in the form of meal speed or duration. Examples of theexpected speed of overall glucose absorption parameter in this case mayinclude, but are not limited to, a compound parameter corresponding toan estimate of the meal speed or duration (such as, for example, unitsof time), a compound parameter corresponding to meal speed or durationrelative to a reference meal speed or duration (such as, for example,dimensionless), or the like.

As another example of providing the estimate of the expected speed ofoverall glucose absorption parameter, the shape and duration of theglucose absorption profile may be mapped to the composition of the meal.Examples of the expected speed of overall glucose absorption parameterin this case may include, but are not limited to, an estimate of fatamount, protein amount and carbohydrate amount (such as, for example, inunits of grams) in conjunction with a carbohydrate content estimate inthe form of meal size or relative meal size, an estimate of fat amount,protein amount and carbohydrate amount relative to reference fat,protein and carbohydrate amounts in conjunction with a carbohydratecontent estimate in the form of meal size or relative meal size, and anestimate of a total glycemic index of the meal or snack (such as, forexample, dimensionless).

The term “total glycemic index” is defined for purposes of thisdisclosure as a parameter that ranks meals and snacks by the speed atwhich the meals or snacks cause the person's glucose level to rise.Thus, for example, a meal or snack having a low glycemic index producesa gradual rise in glucose level whereas a meal or snack having a highglycemic index produces a fast rise in glucose level. One exemplarymeasure of total glycemic index may be, but is not limited to, the ratioof carbohydrates absorbed from the meal and a reference value, such as,for example, derived from pure sugar or white bread, over a specifiedtime period, such as, for example, 2 hours. Other forms of providing foruser input of the expected overall speed of glucose absorption from themeal by the user, and/or for providing for user input of the expectedshape and duration of the glucose absorption profile generally willoccur to those skilled in the art, and any such other forms arecontemplated by this disclosure.

Generally, the concentration of glucose in a person with diabeteschanges as a result of one or more external influences such as mealsand/or exercise, and may also change resulting from variousphysiological mechanisms such as stress, menstrual cycle and/or illness.In any of the above examples, the system 10 responds to the measuredglucose level by determining the appropriate amount of insulin toadminister in order to maintain normal glucose levels without causinghypoglycemia. In some embodiments, the system 10 is implemented as adiscrete system with an appropriate sampling rate, which may beperiodic, aperiodic or triggered, although other continuous systems orhybrid systems may be implemented as described above.

As one example of a diabetes control system, one or more softwarealgorithms may include a collection of rule sets which use (1) glucoseinformation, (2) insulin delivery information, and/or (3) subject inputssuch as meal intake, exercise, stress, illness and/or otherphysiological properties to provide therapy, etc., to manage the user'sglucose level. The rule sets are generally based on observations andclinical practices as well as mathematical models derived through orbased on analysis of physiological mechanisms obtained from clinicalstudies. In the exemplary system, models of insulin pharmacokinetics andpharmacodynamics, glucose pharmacodynamics, meal absorption and exerciseresponses of individual patients are used to determine the timing andthe amount of insulin to be delivered. A learning module may be providedto allow adjustment of the model parameters when the patient's overallperformance metric degrades (such as, for example, adaptive algorithms,using Bayesian estimates, may be implemented). An analysis model mayalso be incorporated which oversees the learning to accept or rejectlearning. Adjustments are achieved utilizing heuristics, rules,formulae, minimization of cost function(s) or tables (such as, forexample, gain scheduling).

Predictive models can be programmed into the processors of the systemusing appropriate embedded or inputted software to predict the outcomeof adding a controlled amount of insulin or other drug to a user interms of the an expected glucose value. The structures and parameters ofthe models define the anticipated behavior.

Any of a variety of controller design methodologies, such as PIDsystems, full state feedback systems with state estimators, outputfeedback systems, (Linear-Quadratic-Gaussian) controllers, LQR(Linear-Quadratic-Regulator) controllers, eigenvalue/eigenstructurecontroller systems, and the like, could be used to design algorithms toperform physiological control. They typically function by usinginformation derived from physiological measurements and/or user inputsto determine the appropriate control action to use. While the simplerforms of such controllers use fixed parameters (and therefore rules) forcomputing the magnitude of control action, the parameters in moresophisticated forms of such controllers may use one or more dynamicparameters. In some embodiments, the one or more dynamic parameters takethe form of one or more continuously or discretely adjustable gainvalues. In some embodiments, specific rules for adjusting such gains aredefined on an individual basis, and, in other embodiments, on the basisof a patient population. In either case these rules will typically bederived according to one or more mathematical models. Such gains arescheduled according to one or more rule sets designed to cover theexpected operating ranges in which operation is typically nonlinear andvariable, thereby reducing sources of error.

Model based control systems, such as those utilizing model predictivecontrol algorithms, can be constructed as a black box wherein equationsand parameters have no strict analogs in physiology. Rather, such modelsmay instead be representations that are adequate for the purpose ofphysiological control. The parameters are typically determined frommeasurements of physiological parameters such as glucose level, insulinconcentration, and the like, and from physiological inputs such as foodintake, alcohol intake, insulin doses, and the like, and also fromphysiological states such as stress level, exercise intensity andduration, menstrual cycle phase, and the like. These models are used toestimate current glucose level or to predict future glucose levels. Suchmodels may also take into account unused insulin remaining in the bloodafter a bolus is given, for example, in anticipation of a meal. Suchunused insulin will be variously described as unused, remaining, or“insulin on board.”

Insulin therapy is derived by the system based on the model's ability topredict a user's glucose level for various inputs. Other modelingtechniques may be additionally used including for example, but notlimited to, building models from first principles.

As described above, system 10 includes an analyte monitor thatcontinuously monitors the glucose levels in a user. The controllermodule is programmed with appropriate software and uses models asdescribed above to predict the effect of carbohydrate ingestion andexercise, among other factors on the predicted level of glucose. Such amodel must also take into account the amount of insulin remaining in theblood stream from a previous bolus or basal rate infusion whendetermining what or whether or not to provide a bolus of insulin.

In a system as described above, the controller is typically programmedto provide a “basal rate” of insulin delivery or administration. Such abasal rate is the rate of continuous supply of insulin by an insulindelivery device such as a pump that is used to maintain a desiredglucose level in the user. Periodically, due to various events thataffect the metabolism of a user, such as eating a meal or engaging inexercise, a “bolus” delivery of insulin is required. A “bolus” isdefined as a specific amount of insulin that is required to raise theblood concentration of insulin to an effective level to counteract theaffects of the ingestion of carbohydrates during a meal and also takesinto account the affects of exercise on the glucose level of the user.

As described above, an analyte monitor may be used to continuouslymonitor the glucose level of a user. The controller is programmed withappropriate software and uses models as described above to predict theaffect of carbohydrate ingestion and exercise, among other factors, onthe predicted level of glucose of the user at a selected time. Such amodel must also take into account the amount of insulin remaining in theblood stream from a previous bolus or basal rate infusion of insulinwhen determining whether or not to provide a bolus of insulin to theuser.

Calibration error is a key fault mechanism for closed loop control oninsulin delivery. Specifically, if the glucose signal being generated bya CGM sensor is calibrated such that the readings are higher than theactual glucose level, the closed loop controller will attempt to drivethese reading into a normal glucose range, and may inadvertently drivethe true, or actual, glucose level into a low glucose range. Detectingand mitigating calibration error is important for robust and safe closedloop control over the delivery of insulin.

In one embodiment of the invention is sensor signal anomalies aredetected and the processor of the controller is programmed to adjust oneor more closed loop system parameters appropriately to ensure that asafe glucose level is maintained. That is, the system may detect aproblem but continue to operate with glucose control that is less thanoptimal. A little higher glucose level may be temporarily tolerated andis safer than an unsafe low glucose level.

Specifically, the CGM sensor generally has a “nominal sensitivity” valuethat best represents a single sensor batch. This ‘nominal sensitivity”is determined at the factory before the sensor is shipped for use. Somemanufacturers attach a sensor code to the sensor that indicates thefactory, or nominal, sensitivity of the sensor. Just prior to thebeginning of closed loop control (or any other appropriate time, such asjust after calibration where a new sensor sensitivity value isdetermined), the system calculates the difference between the current(or most recent, or other sensitivity) and the nominal sensitivity, andif this difference exceeds a predetermined threshold (in the negative orpositive direction or both) then a closed loop system parameter may beadjusted, such that the closed loop system will still maintain safeglucose control in the face of possible calibration error.

FIG. 3 shows a series of receiver operating characteristic (“ROC”)curves 50 for detecting positive calibration bias. In the figure, truecalibration bias is described in terms of True Fractional Accuracy(“TFA”). For example, TFA=1 implies perfect calibration, while TFA=1.2implies a +20% calibration bias. The detector is based on EstimatedFractional Accuracy (“EFA”) computed by taking the ratio of the latestcalibration sensitivity to the sensor-code-based sensitivity (factorysensitivity). A high value of EFA implies a high likelihood of positivecalibration bias. The x-axis 52 depicts the false alarm rate, while they-axis 54 depicts the true detection rate. On the X-axis, a false alarmrate as close to zero is desired. While on the Y-axis, a true highpositive rate as close to one as possible is desired. The straightdotted line between the 0,0 point and the 1,1 point on the graphindicates random accuracy and is undesirable. The various ROC curves 50of FIG. 3 correspond to different levels of true positive biasthresholds as follows:

Curve Drawing Numeral TFA ≦ 1.01 80 TFA ≦ 1.2 82 TFA ≦ 1.3 84 TFA ≦1.325 86 TFA ≦ 1.35 88 TFA ≦ 1.5 90 TFA ≦ 1.7 92For example, the curve labeled with numeral 84 corresponds to a detectorthat attempts to detect positive calibration bias higher than +30%.

In one embodiment, the detector is programmed to detect when maximumtolerable safety limits of the user's glucose level are exceeded duringoperation of a closed loop system. An example of determining the maximumallowable true calibration error in terms of hypoglycemic severity underclosed loop delivery is shown in FIG. 4, where hypoglycemic severity 58is used as one metric to determine a maximum allowable true calibrationerror. The line indicated as “closed loop hypo (hypoglycemic) hazardlimit 100 indicates the maximum severity tolerable. Projecting the point102 at which the TFA line 104 crosses line 100 onto the x-axis indicatesthe maximum allowable calibration error ratio (TFA).

Returning to the notion of using a factory sensitivity check to adjustone or more closed loop parameters, one closed loop parameter adjustmentwould be to raise the upper limit of the controller's target glucoselevel when a significant positive calibration bias is suspected. In theevent that calibration is not really biased positive, the resultinghigher glucose would be tolerable for a short period of time, such as,for example, the remaining life of the sensor, or until the nextcalibration, but would be much safer in preventing inadvertent lowactual glucose level.

Another closed loop parameter adjustment would be to increase the valueof the covariance, or uncertainty, parameter associated with glucosemeasurement uncertainty (assuming that the controller was such as one totake this into account). In addition, the uncertainty parameter may onlybe associated with the scale of the glucose measurement—other uncertainparameters associated with the scale of the glucose measurement, suchas, for example, the higher derivatives of glucose measurement as afunction of time or other variable, may not be adjusted, or adjusteddifferently. An obvious embodiment of adjusting variance is when aKalman Filter framework is used to estimate present system states andpredict these system states in the near future to adjust the variance.In such a framework, each state is being represented by a best estimateand its associated uncertainty level in the form of state variance.

In another embodiment, the results of the sensitivity comparison withthe nominal sensitivity of the sensor may be used to determine if aglucose level (“BG”) measurement is needed, such as, for example, at atime just before closed loop control was initiated, or periodically, forinstance once per day. If the difference between the sensitivitiesexceeds a pre-determined threshold, then the BG reading would berequested by the system, and the resulting sensitivity could be used tofurther detect calibration error (and could be used to drive thepreviously described parameters, or perhaps even disallow closed loopcontrol, or could be used for a new calibration or to trigger another BGrequest). One example of such a system is disclosed in U.S. patentapplication Ser. No. 12/202,302, filed Aug. 31, 2008, which is herebyincorporated by reference in its entirety.

As an example, consider the TFA≦1.2 curve 82 and the TFA≦1.3 84 curve 84shown in FIG. 3. While the curve labeled with numeral 82 might be usefulenough to adjust one or more control parameters, it may not have enoughspecificity to warrant a BG request. However, the curve labeled withnumeral 84 is meant to detect a more severe positive bias, and may haveenough specificity to warrant a BG request. Hence, different EFA-baseddetectors could be employed to induce different levels of behavior.

In yet another embodiment, a single EFA-based detector and EFA value isused to determine several independent actions as shown in FIG. 5. Thisfigure illustrates the use of a single EFA detector to determinedifferent independent actions based on comparing the detector's value toa predetermined series of ranges. For example, when the EFA falls into acertain range of values shown by the bracket 62 (item (1) in FIG. 5labeled “Apply EFA based target range adjustment”), the glucose targetrange can be adjusted to accommodate for mild calibration bias. Once theEFA falls into a certain range shown by the bracket 64 (item (2) in FIG.5 labeled “Request FS”), a BG (by means of a Fingerstick (“FS”) reading)may be requested. However, whenever the EFA exceeds a certain severevalue 66 (item (3) in FIG. 5 labeled “Disable closed loop”), closed loopmust be terminated/disabled.

Other sensor data quality detection methods may also be used to initiateclosed loop control parameter adjustments or trigger BG readingrequests. For example, the parameter adjustments may be designed to befunctions of the sensitivity and nominal sensitivity. For instance, theuncertainty parameter may linearly increase proportional to increases inthe difference between recently-measured sensitivity and nominalsensitivity. In addition, the detection of possible calibration errorusing recently-measured sensitivity and nominal sensitivity may befurther enhanced by the logical addition of other factors, such asvariability in previous immediate sensitivities.

Insulin delivery via pumps has been designed to approximate thephysiological delivery of insulin. This is done through the use offast-acting insulin that is delivered in two ways. Basal insulin is oneor more low rates of insulin administration delivered throughout the dayto account for normal fluctuations in glucose level that occur duringthe day. Bolus insulin is a comparatively large dose of insulin that isdelivered over a relatively short period of time and is generally usedto cover the carbohydrate load of a meal or to correct a high glucoselevel. Modern insulin pumps make use of both of these modes of insulindelivery.

Under closed-loop glucose control, the traditional distinction betweenbasal and bolus glucose may become blurred. Under closed-loop control,insulin may be delivered at regular intervals, the timing and size ofwhich may be based upon the determination of a control algorithm,utilizing the input provided by a continuous glucose sensor or monitor(“CGM”), targeted to maintain (or achieve) prescribed levels of glucosein a user. This moves dramatically away from the current standard ofpre-programmed basal rates and intermittent user-selected bolusdeliveries.

Closed-loop insulin systems that make use of standard or semi-custominsulin pumps or which incorporate times of open-loop insulin deliverymay be required to utilize the existing paradigm of basal/bolus insulindelivery within their control approaches.

Many closed-loop algorithms in development are based upon the deliveryof insulin boluses in regular intervals. In this case, the approach thathas been widely used is to deactivate (or set to zero) the normallyactive pump basal rate of insulin delivery. This approach may bedisadvantageous because any prolonged interruption of the closed-loopsystem (such as, for example, due to loss of RF communication betweenpump and controller) may lead to a substantial under delivery ofinsulin, since basal delivery would have been previously deactivated andcommands for insulin boluses would not be received by the pump.Depending on the cause of cessation, the user may not receive an alertinforming of this condition.

One exemplary approach to mitigate this risk in accordance with variousembodiments of the invention is to leave a pre-programmed safe-level ofbasal delivery active during closed-loop control involving bolusdelivery of insulin. With each issued bolus command by the algorithm, acommand issuing a temporary basal rate of zero units/hour for apredetermined time is sent to the pump. It is envisioned that basaldelivery would be re-suppressed after each successful closed-loopinsulin delivery cycle. Thus, the expiration of the temporary basaldelivery rate would serve as a watchdog that reactivates the pump'spre-programmed basal rate after a period without successful closed-loopcontrol. This suppresses basal rate delivery of insulin duringclosed-loop operation and reduces the risk that in the event ofunexpected cessation of closed loop operation that the user would beleft without active insulin delivery.

In other embodiments, the temporary basal rate delivery may be set tosome other (non-zero value) as determined by the control algorithm. Instill other embodiments, the duration of the temporary basal rate couldbe some value other than a single closed-loop cycle, such as, forexample, duration of the temporary basal rate could be for two, three ormore closed-loop cycles.

In still other embodiments, the duration of the temporary basal rate maybe determined based upon the amount of insulin delivered in thepreceding closed-loop cycle or may be based upon the level of insulinonboard (IOB). For example, if the user has a high-level of IOB, thealgorithm may issue a temporary basal rate of zero units/hour (orsimilar) that lasts for a longer time than if the user has low IOB.

In yet another embodiment, the duration of the temporary basal rate maybe determined based upon the amount of insulin delivered in thepreceding closed-loop cycle or could be based upon the level of insulinonboard (IOB) in conjunction with the knowledge of the pre-programmedbasal rate. For example, if the user has a high level of IOB, and thepre-programmed basal rate is judged to be high, the algorithm couldissue a temporary basal rate of some duration of zero units/hour (orsome level of insulin delivery that is lower than the pre-programmedbasal rate). Similarly, if the user has a lower level of IOB, and thepre-programmed basal rate is judged to be low, the algorithm may issue atemporary basal rate of some duration of non-zero units/hour higher thanthe pre-programmed basal rate.

In the present state of artificial pancreas research, investigatorstypically choose to use insulin as a means of controlling a person'sglucose level. Defining this process in terms of control theory as it isunderstood by those skilled in the art, this control action is singledirectional in that only a non-negative insulin dosage can beadministered, and since it can only decrease glucose level, there isusually no safety mechanism to determine the lowest insulin deliveryrate under a closed loop delivery system other than a zero rate. Atbest, there may be a constant nonzero minimum delivery rate.

The need for a safety mechanism that governs a non-zero and possiblytime-varying minimum basal rate of insulin delivery arises from thecoupling effect of a negative calibration bias in the continuous glucosemonitor (“CGM”) component that will falsely under represent glucose tothe controller.

Since a negative calibration bias of the CGM causes the controller toperceive that the user has a lower glucose level than is actuallypresent, the controller determines a lower amount of insulin than theuser may require to control the user's actual glucose level. At theextreme, the controller may even decide to halt insulin delivery. Whilethis action is justified when the user is actually experiencinghypoglycemia, it can result in undetected and uncontrolled hyperglycemiawhen coupled with a negative calibration bias.

In one embodiment of the invention, the processor of the controller isprogrammed using appropriate software or hardware commands to functionin a manner so as to provide a safety mechanism that accounts for thecoupling of a negative calibration bias and the hazard of hyperglycemiadue to delivering a reduced amount of insulin, not delivering insulin,or delivering an opposite action such as glucagon to the user'sbloodstream.

Model-based control allows for a rational weighting between observeddata (such as, for example, measurement data obtained from CGM sensors,user-announced meals, and the like) and the best estimate of the truevalues of glucose levels based on an internal model tracked by thesystem.

Along the same lines, a model that keeps track of the user's typicalinsulin history in the various compartments as followed by the model canbe used to mitigate against instances where a naïve calculation ofinsulin delivery based on the CGM value would result in a very low or nodelivery over an extended period of time.

In another embodiment, a simple model is used to track theinsulin-on-board (IOB) of the user such that a pattern is established.This pattern may be based either on online user data, that is datagenerated in real time, or data that has been collected from a user overtime, offline collection of data for many users, or a combinationthereof, such that regardless of what the glucose-based measurementsindicate, the system will attempt to mitigate the hazards of insulindeprivation. Diurnal pattern or other patterns of this IOB history couldbe identified using available data.

Following the various model-based measures of insulin, either in termsof specific insulin compartment of a model, a series of insulincompartments of a model, or IOB, the programming of the processorembodying the safety mechanism attempts to determine the maximumduration that the model can allow the user to have a low amount ofinsulin. Four examples of the use of such a safety mechanism inaccordance with the various embodiments of the invention are describedbelow:

-   -   1. Assume one low glucose threshold has been exceeded. Then,        depending on the aggressiveness of the safety mechanism, that        is, the sensitivity of the mechanism and the trigger points at        which the mechanism will determine that an action must be taken,        the amount of insulin as computed by the system prior to taking        into account for this mechanism will be bounded from below by        this safety mechanism. For example, assume that due to a        negative CGM calibration bias, the controller (without the        safety mechanism of aspects of this invention) has been        delivering a steady rate of 0.05 units of insulin (per hour).        Now also assume that the IOB-based safety mechanism is        activated, and the safety mechanism determines that the amount        of IOB has been lower than a pre-determined threshold for a        pre-determined amount of time. Then, the safety mechanism        overrides the delivery rate and commands the pump to increase        the delivery rate to a pre-determined amount, such as, for        example, 0.15 units (per hour) for a pre-determined amount of        time, until the safety mechanism determines that the IOB has        returned to a minimum safety limit.    -   2. In yet another embodiment, the safety mechanism programmed        into the processor does not necessarily ensure a certain minimum        IOB by intervening in the insulin command. Instead, the safety        mechanism issues a CGM validity confirmation. Examples of such a        confirmation include providing the user with a request to        recalibrate the CGM system or a requesting the user to obtain a        glucose level measurement using an alternate device. If the CGM        system used for closed loop feedback is significantly biased, a        recalibration or a confirmation from an alternate device may        reveal the source of the low IOB.    -   3. In yet another embodiment, different levels of threshold are        used to determine a combination of the two types of action        previously described. The safety mechanism may initially decide        to ensure that a certain minimum amount of insulin is delivered,        and that delivery minimum may vary over time. During this time,        the system may or may not alert the user that the user is in a        hypoglycemic state. Beyond this point, the safety mechanism may        determine that the risk mitigation itself may be too risky to        continue in the event that the user really is in hypoglycemia.        Before the risk approaches a tolerable limit, the safety        mechanism may opt to follow the second path described, in that        either a CGM recalibration is requested, or an alternate        measurement is requested. Otherwise, the closed loop system will        terminate operation.    -   4. In yet another embodiment, the same limitations can be        extended to the case when a bidirectional means of controlling        glucose is employed. One example is the use of insulin to reduce        glucose and glucagon to induce the liver to release glucose        (thereby making more glucose available in the circulation). If        the system determines either to deliver less insulin, halts        insulin delivery, or delivers glucagon contrary to the safety        mechanism described herein, the safety mechanism can react in        the manner described in examples 1 through 3 above.

A negatively biased CGM system used for closed loop operation typicallyresults in a reduced or discontinued insulin delivery. Even worse, aclosed loop system employing a bidirectional means of control (forexample, in a system using insulin to lower glucose level and usingglucagon to raise glucose level) may even force the patient into furtherhyperglycemia with the release of glucagon. The safety mechanism isprogrammed appropriately to ensure that the safety mechanism does notunnecessarily increase the acute hazard of hypoglycemia while attemptingto protect the user from hyperglycemia.

Prior to the start of closed-loop insulin delivery, it is likely that areference glucose level measurement will be obtained by the patient inorder to ensure that the glucose sensor is functioning properly (suchas, for example, appropriately calibrated to reflect glucose levels).This reference glucose level measurement may be prompted by theclosed-loop software, allowing for an automated determination of theproper functioning of the sensor, or may be performed procedurally,where a user obtains a reference glucose level measurement (such as, forexample, a fingerstick glucose reading) and makes a determination ofwhether or not the sensor is functioning properly based upon definedrules (such as, for example, a table of acceptable ranges of sensorglucose reading for a given reference glucose level). This step may berequired by the closed-loop software in order to initiate a closed-loopsession or may be used to inform the determination of the aggressivenessor set-point of the closed loop algorithm. An example of such a systemis disclosed in U.S. patent application Ser. No. 12/202,302 filed Aug.31, 2008 which is hereby incorporated herein by reference in itsentirety.

As a matter of safety, it may be desirable to have an asymmetrical rangefor acceptable CGM bias, as determined by comparison with the referenceglucose level measurement, prior to the start of closed-loop insulindelivery. For example, clinical or simulated data of the controlalgorithm can be used to determine the level of high calibration biasthat yields acceptable glucose level control. Using these data, anacceptable level of high calibration bias under which closed-loopcontrol should be activated can be determined (such as, for example,+50%). If the calibration bias is higher than this level, the user maybe directed to perform a manual (forced) calibration prior to initiatingclosed-loop control, or some other output could be initiated. In asimilar manner, if a reference glucose level measurement indicates thatthe CGM is biased lower than a certain level, the user may be directedto perform a manual (forced) calibration prior to initiating closed-loopcontrol. As used herein, “manual calibration” is a calibration of theglucose monitor or sensor that is initiated by the user as opposed tobeing initiated by the controller requesting the patient to conduct acalibration.

The levels of high and low bias that are deemed acceptable for theinitiation of closed-loop control are dependent on the nature of theclosed-loop algorithm. Algorithms can be designed such that they arerobust to high calibration bias, such as through imposed limits on therates of insulin delivery or through other approaches.

Low calibration bias, however, presents a unique challenge. If the lowbias is due to an anomalous depressed sensor output, such as, forexample, due to early sensitivity attenuation (“ESA”) or dropoutbehavior instead of a calibration that results in a low biased reading,performing a manual calibration may not be desirable as subsequentrecovery from the depressed sensor output may result in very high sensorbias, potentially leading to dangerous levels of hypoglycemia.

It may therefore be desirable to allow closed-loop to begin underconditions of large level of low calibration bias rather than require amanual calibration prior to initiating the closed-loop session. This maybe true despite the additional hyperglycemic exposure to which the userwill likely be subjected due to the low sensor bias because of thegreater relative risk of hypoglycemia which may occur due to recoveryfrom an anomalously depressed output. Alternatively, manual calibrationsperformed with large low calibration bias may only be accepted by thesystem under certain conditions. For example, manual calibrationsperformed during a low bias state may require a follow up measurement ata later time to confirm that the manual calibration corrected the bias.

Accordingly, the controller may be programmed to accept an asymmetricalrange for acceptable CGM bias (as measured by reference BG measurement)prior to starting of closed-loop. The processor may also be programmedto require manual (forced) calibrations outside of this range in orderto initiate a closed-loop session.

This approach of these embodiments may also be extended to CGM devicesused outside of closed-loop insulin delivery. That is, manualcalibrations may only be accepted by the system if the existing bias (asdetermined by a reference glucose level measurement) is outside of someasymmetric range.

In a further embodiment of the invention, new safety features areprovided to allow a continuous glucose monitor (“CGM”) condition orconditions to terminate pump delivery, specifically terminating extendedbolus delivery, programmed basal rate delivery, and temporary basal ratedelivery (if it is higher than the programmed basal delivery rate) or toreduce future basal delivery rates. These safety features can beimplemented in open loop, semi-closed loop, or closed loop systems.

The embodiments of the invention incorporating such safety features areparticularly useful for insulin deliveries that are not instantaneous oron-demand (such as, for example, a one time delivery that lasts only afew minute), like a normal meal bolus of insulin. There are severalinsulin delivery modes that are not instantaneous, or are scheduled forlonger term insulin deliver, such as, for example, programmed basal rateinsulin delivery, temporary basal rate insulin delivery, and extendedbolus insulin deliver. Programmed basal rate insulin delivery is thebasal rate of insulin delivery that is typically delivered throughoutthe day. Temporary basal rate insulin delivery can be programmed tooverride the programmed basal insulin delivery rate, and a temporarybasal rate insulin delivery is typically carried out when there is abreak in a user's daily routine. For example, if a pump user who usuallyworks outdoors for some reason has a classroom training one afternoon,he may choose to change his basal insulin delivery rate for thatafternoon. Alternatively, the user may instead program a temporary basalrate lasting several hours in duration. After this duration is reached,the pump returns to the programmed basal rate of insulin delivery.Additionally, an extended bolus is a bolus that is scheduled over aperiod of time instead of an instantaneous bolus. Typically the pumpuser gives a normal bolus (or instantaneous bolus) for a single mealthat is consumed at one time. If the user snacks throughout theafternoon (such as, for example, at a social gathering), the user mayprogram the pump to deliver an extended bolus of insulin is deliveredover several hours. In addition, an extended bolus of insulin is alsoused when there is higher fat/protein content in the food that is to beingested. Higher fat content in a meal will usually delay the onset ofthe glucose spike in the user's glucose level profile due to the meal.In this case, the pump user may choose to deliver an extended food bolusover a selected period of time, such as, for example, the next 30 to 90minutes, instead of programming the bolus to be given all at once at,say, 15 minutes before the meal.

In a combined CGM and pump device, an extended bolus or temporary basal(when greater than the programmed basal rate) could be terminated basedon the condition of the current CGM glucose level measurements. Forexample, if the current IOB and the current CGM measurements indicatethe user may be carbohydrate deficient already or trending towards beingcarbohydrate deficient, then for safety reasons, such as, for example,to prevent hypoglycemia, the pump may automatically terminate or suspendfurther delivery of the programmed extended bolus delivery of insulin.The decision to terminate may be arrived at by the processor byprogramming the processor to consider one or more of the followingparameters:

-   -   IOB—in conjunction with a CGM reading, whether the user is in a        carbohydrate deficient state or not    -   Current CGM reading—in conjunction with IOB, whether the user is        in a carbohydrate deficient state or not    -   Current CGM rate of change—is the trend of the measured glucose        level going up or going down and how fast is the trend changing?    -   Projected BG Threshold—how soon will the user cross the low BG        threshold, that is, what is the estimated time until the user's        glucose level crosses the threshold and places the user at risk        of hypoglycemia?    -   Low BG Threshold—once the user crosses the low BG threshold, how        much time is estimated, based on the user's JOB, current glucose        level and insulin and glucose history, remains before the user        is in a dangerous hypoglycemic state?    -   Has the processor annunciated any alarms to the user indicating        that the user's glucose level is dangerously low, and has the        user taken any action to resolve the alarm, or has the user        ignored the alarm?

In addition to terminating an extended bolus or a temporary basal rateinsulin delivery that is higher than programmed basal before thescheduled termination time, the system may choose to terminate orsuspend a programmed basal delivery by setting a temporary basal ofzero, or the processor may issue a command to reduce the future basaldelivery rate by setting a temporary basal rate to be less than thecurrent programmed basal delivery rate for a selected duration that iseither pre-defined, calculated, or defined by the user to allow the userto recover from the carbohydrate deficient state.

How much basal reduction and/or the duration of the basal reduction (bysuspending basal rate completely by setting the temporary basal rate tozero, or by reducing future basal rate to lower than programmed basalrate) can be calculated by the processor to determine the amount of theinsulin reduction needed to recover from the carbohydrate deficientstate. In one embodiment, this calculation is performed by the processorexecuting suitable programming commands and using a stored value for theuser's insulin sensitivity factor (“ISF”) value that is typicallyavailable for user's undergoing insulin pump therapy to treat theirdiabetes.

For example, the IOB value for the user, the current CGM glucosemeasurement, and the user's ISF allow the processor of the controller orpump to calculate how much extra insulin is in the body than the amountneeded to metabolize the amount of carbohydrates ingested by the user atthe last snack or meal. This calculated excess is the total insulinreduction needed to resolve the carbohydrate deficient state.

The processor also analyzes the CGM glucose measurement value and thepresence or absence of a currently pending low glucose level alarm orprojected low glucose level alarm to determine whether to command alarge reduction in insulin delivery or a complete suspension of basalinsulin delivery for a short period of time is warranted to avoid animminent state of hypoglycemia. Depending on the thresholds programmedinto the processor concerning the user's glucose level, alarm state andJOB, the processor may be programmed to take either an aggressiveintervention, or a less aggressive intervention in ceasing or alteringthe current basal rate. For example, the processor may be controlled bya software embodied CGM projected alarm algorithm that may project thetime at with a low glucose level will be reached, and the processor maythen use this value as the duration of the temporary basal rate. Withthis value, the amount of insulin delivery reduction needed to resolvethe user's carbohydrate deficient state may be calculated. The processorthen sends the appropriate command to the pump to either cease basalrate insulin delivery or reduce the rate of insulin delivery so thatover time the user's glucose level profile trends away from hypoglycemiatowards euglycemia at an acceptable rate.

In some cases, a more gradual reduction in basal insulin delivery ratemay be preferred if the current CGM glucose level measurement, whencompared to the IOB, stored insulin history and projected glucose levelprofile by the processor, indicates that no imminent hypoglycemia willoccur, and that a more conservative intervention of the current basaldelivery rate can be used to bring the user's glucose level profile intoan acceptable range. Using the data available to it, the processor canbe programmed to determine the percentage reduction in insulin deliverthat is gradual enough to reach the desired level, and thenback-calculate the duration of delivery at the selected rate needed toreach the total insulin reduction desired.

Alternatively, in a semi-closed loop system, or a fully closed loopsystem that is in an open loop state, the closed loop predictive modelmay still inform the user of the amount and duration of the basal rate.

Furthermore, the system may inform the user that a carbohydratedeficient state has been reached and the recommend to the user thenumber of carbohydrates needed to metabolize the extra insulin that thesystem has determined is present. The processor may be programmed to notonly determine a course of action of stopping or slowing insulindelivery, but the processor may also recommend to the user that the usersimply consume extra carbohydrates to cover the extra insulin in theuser's body.

In another embodiment, the controller may be programmed to terminate anextended bolus delivery or terminate or reduce future basal insulindelivery when both IOB or CGM glucose level measurements are availableor when certain CGM events occur (such as, for example, where the user'sglucose level is trending towards hypoglycemia) or when certain pumpevents occur (such as, for example, where an extended bolus delivery, orwhere the processor had determined to employ a temporary basal deliveryrate that is less than the programmed basal delivery rate) or acombination of these events and glucose level conditions.

In addition, with the availability of CGM and IOB readings, a safetylimit on the possible IOB level can be implemented by the programming ofthe processor to provide an additional bolus safeguard that prevents theuser from over-dosing insulin using bolus deliveries of insulin. Forexample, this function can prevent the user from making any correctionbolus that would raise the user's projected IOB over the safety IOBlimit that is calculated from the current CGM glucose level measurementso that the user avoids entry into a carbohydrate deficient state.Furthermore, the processor can be programmed so that the user candeliver a food bolus only in conjunction with a meal, the amount of thebolus allowed to be given dependent on whether the bolus andcarbohydrate amount of the meal will raise the IOB over the safety IOBlimit.

The various embodiments of the present invention, embodied in suitableprogram commands executed by the processor of the controller or pump,provide new safety features that previous generations of insulin pumpsare unable to provide because they do not have access to CGM glucoselevel measurements. In the past, an extended bolus insulin delivery,temporary basal rate insulin deliver, or programmed basal rate insulindelivery could only be terminated early through manual intervention bythe user. However, given the integration of the CGM, pump andcontroller, the system can be programmed to implement auto-terminationas an additional safety mechanism in case certain CGM glucose levelconditions are reached.

The integration of CGM allows better monitoring of excess insulin andcan provide the user with more options to recover from a carbohydratedeficient state than just eating more carbohydrates. One undesirableside effect of such a strategy is that is often leads to unwanted weightgain. As described above, programming the processor of the controller orpump in an integrated system provides for automatically orsemi-automatically reducing a future basal delivery rate of insulinusing the temporary basal functions embodied in the software andhardware of the present invention to improve safety and compliance ofinsulin pump use.

While the invention has been described in connection with what ispresently considered to be the most practical and preferred embodiments,it is to be understood that the invention is not to be limited to thedisclosed embodiments and elements, but, to the contrary, is intended tocover various modifications, combinations of features, equivalentarrangements, and equivalent elements included within the spirit andscope of the appended claims. Thus, it is intended that the presentinvention covers modifications and variations of the examples shown.

1. A system for the delivery of insulin to a patient, the systemcomprising: a continuous glucose sensor configured to provide a glucoselevel signal representative of sensed glucose, the sensor having anominal sensor sensitivity; an insulin delivery device configured todeliver insulin to a patient in response to delivery control signals;and a controller programmed to receive the glucose level signal, receivethe nominal sensor sensitivity, and receive a sensor sensitivitymeasurement, and to determine a delivery control signal to control thedelivery device in accordance with the sensor glucose level signal and acomparison of the sensor sensitivity measurement with the nominal sensorsensitivity.
 2. The system of claim 1 wherein the controller furthercomprises one or more safety-oriented components programmed in thecontroller by software commands that modifies the control behavior ofthe processor such that the behavior of the processor is a function ofestimated sensor calibration accuracy.
 3. The system of claim 2 whereinthe controller estimates the sensor calibration accuracy based onpresent and past data from the glucose sensor as well as past offlinedata.
 4. The system of claim 2 wherein a safety-oriented componentprogrammed in the processor by software commands detects a sensorcalibration anomaly and adjusts at least one parameter selected from thelist of parameters consisting of target glucose range limits, a varianceof one or more glucose state estimates, a variance of one or moreglucose sensor measurement channels, a calibration correction factor tobe used in conjunction with the glucose sensor's glucose level signal, adecision by the processor based upon data available from the glucosesensor and at least one other selected parameter value to request arecalibration, and a decision by the processor based upon data availablefrom the glucose sensor and at least one other selected parameter valueto terminate closed-loop operation.
 5. A system for the delivery ofinsulin to a patient, the system comprising: a continuous glucose sensorconfigured to provide a glucose level signal representative of sensedglucose; an insulin delivery device configured to deliver insulin inresponse to delivery control signals at a basal rate and as a bolus; anda controller programmed to receive the sensor glucose level signal andto provide a delivery control signal to an insulin delivery device tosuspend a basal delivery rate during the provision of a bolus deliveryand to automatically resume a preprogrammed basal delivery rate after aselected event.
 6. The system of claim 5 wherein the delivery controlsignal comprises automatic resumption of the basal delivery rate aftertermination of the bolus rate.
 7. The system of claim 5 wherein thedelivery control signal comprises automatic resumption of the basaldelivery rate after a selected period of time has elapsed sincetermination of the basal delivery rate.
 8. The system of claim 5 whereinthe delivery control signal comprises automatic resumption of the basaldelivery rate after comparison of a value of insulin on board asdetermined by the processor to a selected threshold value for insulin onboard stored in a memory in operable communication with the processor.9. A system for the delivery of insulin to a patient, the systemcomprising: a continuous glucose sensor configured to provide a glucoselevel signal representative of sensed glucose; an insulin deliverydevice configured to deliver insulin in response to delivery controlsignals at a basal rate and as a bolus; and a controller programmed toreceive the sensor glucose level signal and to provide a deliverycontrol signal to the insulin delivery device according to a model, themodel including a monitor on the lower level of insulin over the courseof time such that if the delivery control signal reduces the insulindelivery below a threshold or terminates insulin delivery, the processormodel programming of the processor results in an intervention in thedelivery of insulin by the pump to avoid hypoglycemia.
 10. The deliverysystem of claim 9 wherein the model programming of the processor resultsin an intervention in the delivery of insulin until the risk ofover-compensating in an opposite direction is determined to be higherthan not intervening in the insulin delivery.
 11. The delivery system ofclaim 10 wherein the model programming of the processor results in anintervention of the insulin delivery within a selected duration but whenthe selected duration is exceeded and the model programming of theprocessor suggests that the risk level is still unacceptable, the modelprogramming of the processor evaluates taking another action, such asrecalibration or termination of full or partial system automation.
 12. Asystem for the delivery of insulin to a patient, the system comprising:a continuous glucose sensor configured to provide a glucose level signalrepresentative of sensed glucose; an insulin delivery device configuredto deliver insulin to a patient in response to delivery control signalsat a basal rate and as a bolus; and a controller programmed to receivethe sensor glucose level signal and to provide a delivery control signalto the insulin delivery device to deliver insulin in a manner thataccounts for an asymmetrical bias range of the glucose sensor such thatinaccuracy in the sensor may be tolerated with limited hyperglycemiawhile avoiding hypoglycemia.
 13. A system for the delivery of insulin toa patient, the system comprising: a continuous glucose monitorconfigured to provide a glucose level signal representative of sensedglucose; an insulin delivery device configured to deliver insulin to apatient in response to delivery control signals; and a controllerprogrammed to provide control signals to the delivery device to resultin a basal rate of delivery and bolus delivery, the controller alsoprogrammed to receive the glucose level signal and to indicaterecommended changes to the delivery of insulin and/or alter the deliveryof insulin as a function of the glucose level signals.
 14. The deliverysystem of claim 13 wherein the controller provides delivery controlsignals to alter the delivery of insulin based on a glucose level signalindicating existing, imminent, or a trend toward carbohydratedeficiency.
 15. The delivery system of claim 13 wherein the controllerprovides delivery control signals to terminate an extended bolus and toterminate a temporary basal rate that exceeds a programmed basal rate inresponse to a glucose signal indicating existing or imminentcarbohydrate deficiency.
 16. The delivery system of claim 13 wherein thecontroller provides delivery control signals to terminate a programmedbasal rate and alter future basal delivery of insulin in response to aglucose signal indicating existing or imminent carbohydrate deficiency.17. The delivery system of claim 13 wherein the controller: receives theglucose level signal from the sensor; informs a patient of a trend inthe patient's glucose level toward carbohydrate deficiency; andindicates an option of consuming carbohydrates to alter the trend to thepatient.